The value of Sarbox

I'm a commerically focused finance leader rather than a conservative "dot the Is and cross the Ts" accountant. And like many colleagues in Europe and the US, I've spent a lot of time dealing with S404 Sarbanes Oxley compliance, where senior management needs to sign off on the existence of business controls. The consequence is that you need a huge system documenting line managers proving that they have detailed controls at every level of management. Initially, it seemed completely ridiculous. However, it's not all bad.

Firstly, on a personal note: the defining moment that caused me to move into finance was not a turnaround or a big investment. It was basic business controls. I went to Indonesia in the days of the Tiger Economy boom. Business was growing fast, deals were being made, parties were being had and Jakarta was full of expats, money, long nights and gorgeous girls. I was doing post-implementation work with MFG/PRO, reporting to the Finance Director (an austere Dutchman from the northern protestant provinces). He had an internal audit report that was critical about the management of credit risk to our customers, although there were actually no indications of credit problems in an environment of 20% growth. However, we sat down and went through the customers, updating credit ratings, liens, mortgages and bank guarantees necessary. To some customers we said goodbye. Sales management was puzzled.

Then the great crash occurred. You probably had to be there to see how dramatic it was. To say the economy crashed "overnight" is a partial exaggeration: "overnight" took about four weeks. But it was a crash like I've never seen before or since. Almost all building projects were financed on 4 to 6 week rolling credit, and when the banks collapsed, the money was quickly sucked out of the economy. Cranes were simply left standing in the wind as all around Indoensia investment projects were just walked away from. However, simply by the good discipline of some months earlier, with no clouds on the horizon, Philips was ready. Our slimmed-down customer base were survivors and we were confident of them; competitors collapsed. Philips actually prospered, the market share became dominant, and the family-owned distributors key to Indonesian retail will remember the loyalty and reliability of Philips for a couple of generations (we know this because competitors tried to buy their way into the distribution when they were ready to return, but they struck hard rock).

So I believe in business controls. They are an important way of being prepared for uncertainty, and an essential part of the special responsibilty the finance function has for safeguarding the business.

Sarbox imposes a requirement to prove that you have effective business controls. It had some strange effects. Compliance requires specialised expertise, so our internal audit saw it as a chance to move into others things (such as auditing supply chain and product development performance), leaving the old job of supervising controls to the new partnership of senior management and external firms. This partnership caught operational finance teams in the middle; the donkey work fell to them.

There's been a lot said about the waste of Sarbox, and most of it is true. However, there are some potential benefits which you may as well try to take advantage of.

1) Standardisation of processes

2) It's a good template for upgrading controls at new and acquired businesses.

The biggest risk of Sarbox is the American belief that you can transpose culture into rules, and when this becomes difficult, make more detailed rules. In other words, Sarbox can corrode a good culture by convincing people that business control is a routine process of filling in database reports.

The second biggest risk is the disillusionment of finance people. If you tell them that finance is a business partner adding value to the business, and then require hours of overtime on numbingly dull activities that don't add value is a big credibility problem.